Spain’s New 400 Prefix for Commercial Calls: What It Tells You — and What It Doesn’t

Since 17 October 2026, Spain has a dedicated phone-number range for many commercial calls: nine-digit numbers beginning with 400.

The idea is simple. Before answering, you can recognise that the call has a commercial purpose. A company may be trying to sell a product, promote a service or acquire a customer.

That is useful information.

But it still leaves one very practical question unanswered:

A 400 number can tell you why someone is calling. But does it tell you who is calling?

Not necessarily.

Spain's new system creates a clearer distinction between commercial calls and other telephone communications. It also gives telecom operators new tools to identify and block non-compliant traffic. But the 400 prefix is primarily a purpose label. It is not, by itself, a consumer-facing identity certificate for the company behind the call.

What changed in Spain on 17 October 2026?

Spain created the 400 number range as part of a broader effort to make commercial communications more transparent and to reduce fraudulent and misleading telephone traffic.

The legal basis comes from Spain's Law 10/2025 on Customer Service and a resolution issued by the Secretary of State for Telecommunications and Digital Infrastructures on 14 April 2026.

The resolution reserved the national numbering code 400 for commercial calls and gave regulators, telecom operators and affected companies six months to make the new range operational.

The resolution took effect on 17 April 2026. Six months later, on 17 October 2026, the 400 system became operational.

These are normal nine-digit Spanish telephone numbers whose first three digits are 400.

Does every company in Spain have to use a 400 number?

This is where headlines can be slightly misleading.

Government communications frequently describe the change simply as a new requirement for “commercial calls”. The underlying legal resolution is more precise: the 400-only requirement is tied to companies that fall within the scope of Law 10/2025, with specific exceptions preserved by the legislation.

The law covers businesses providing certain basic services in Spain, including:

• water, gas and electricity;
• passenger transport;
• postal services;
• electronic communications and telephone services;
• financial services.

It also covers large companies and corporate groups selling other goods or services primarily to consumers in Spain when they meet at least one of the statutory size thresholds.

That means a commercial call arriving from a number that does not start with 400 should not automatically be treated as a scam. The caller may fall outside the relevant 400 obligation or within an exception.

But where a company is covered by the rule, commercial calls should use the dedicated range.

A commercial call and a customer-service call are now deliberately different

One of the most useful ideas behind the new rules is that a company should not use the same telephone identity for two very different purposes.

Imagine receiving a call from your telecom provider.

It could be calling because there is a problem with your existing contract. Or it could be calling because it wants to sell you a more expensive package.

Those are not the same interaction.

Spain's Customer Service Law requires customer-service activity to be clearly distinguished from commercial activity. The 400 range is reserved for the commercial side.

Customer-service calls can instead use the specifically authorised short numbers, freephone ranges such as 800 and 900, or geographic numbers, depending on the applicable rules.

A 400 number is not supposed to be a company's ordinary customer-service number.

Why can't you call a 400 number back?

The 400 range is intentionally one-way.

The official April 2026 resolution says that 400 numbers are exclusively for originating commercial calls and are not enabled to receive incoming calls.

In practical terms:

• a company can call you from a 400 number;
• you can see the 400 number on your phone;
• but you cannot return the call to that number.

The government argues that this reduces the risk associated with returning an unfamiliar commercial call and prevents the new range from becoming another general-purpose incoming-call channel.

But this design creates an interesting consequence.

If you want to verify the caller independently, you cannot simply press “call back”. You need another trusted way to identify the organisation and find its official contact details.

Does a 400 number mean the call is legal?

No.

This is probably the most important distinction to understand.

The numbering rule and the permission to make a commercial call are separate questions.

A company can use the correct 400 range and still have to comply with Spain's privacy and marketing-call rules.

The Spanish Data Protection Agency, AEPD, states that an unsolicited commercial call involving a human operator generally requires either:

• the user's prior consent; or
• another valid legal basis, particularly a legitimate interest that can satisfy the applicable conditions.

One common example of legitimate interest may exist where there is a previous contractual relationship, the company lawfully obtained the contact details and it is promoting similar products or services of its own.

There are additional safeguards.

At the start of a commercial call, the caller should identify the business, explain the commercial purpose of the call and tell the user about the possibility of withdrawing consent or exercising the right to object.

An unequivocal request not to receive further commercial calls must be treated as a withdrawal of consent or an exercise of the right to object, as applicable.

Automated commercial calls without human intervention, such as prerecorded marketing messages, generally require prior consent.

What if you buy something during an unsolicited call?

Spain's 2025 Customer Service Law also strengthened consumer protection around contracts concluded by telephone.

The law amended Spanish consumer legislation so that when a telephone contract is concluded in breach of the rules governing unsolicited calls, the consumer is presumed not to have had the required intention to contract and the contract becomes void.

The law also states, for this purpose, that consent to the call is treated as absent if it was not expressly obtained or renewed during the two years before the communication.

There is a specific exception in the legislation for certain loan and credit contracts, where different consequences apply.

The practical lesson is straightforward:

The existence of a 400 number does not remove the company's obligations around consent, transparency and consumer protection.

Does a 400 number tell you which company is calling?

This is where the system still has an important gap.

A 400 prefix immediately tells you something useful:

the number is being used as commercial-call numbering.

But that is different from knowing:

• which company is behind the number;
• which brand it represents;
• whether an external call centre is making the call;
• what product or campaign the call relates to;
• whether the organisation's claim during the call is genuine.

Spain's CNMC maintains the national telecommunications numbering register, including information about number assignments and authorised subassignments.

That is valuable infrastructure information.

But it is not the same thing as a simple consumer-facing directory that lets someone enter every 400 number and immediately see the company responsible for that commercial call.

This is exactly the issue raised by Spanish consumer organisation OCU. In October 2026, OCU welcomed the new 400 range but called for a public registry that would make it possible to identify which company is behind each commercial number.

400 can tell you the purpose of the call. Identity is another layer.

Purpose, identity and authenticity are three different things

It helps to separate three questions that are often treated as one.

This distinction matters because telephone trust is not a single yes-or-no question.

Knowing that a call is commercial is useful. Knowing which organisation is associated with the number is better. And determining whether a particular interaction is trustworthy may still require independent verification.

Does a 400 number mean the call is a scam?

No.

The 400 range was created for legitimate commercial calling. Receiving a call from a 400 number therefore does not mean you are receiving a fraudulent call.

Equally, you should not assume that every statement made during a 400 call is true simply because the number uses the correct prefix.

Normal safety rules still apply.

• Do not disclose passwords or PINs.
• Do not provide one-time security codes to an unexpected caller.
• Be cautious if the caller creates urgency or pressure.
• Do not treat personal information the caller already knows about you as proof of identity.
• If the conversation becomes sensitive, contact the organisation independently through a trusted official channel.

You can read more in How to Check if a Phone Number Is a Scam and How to Tell if a Call Really Comes from Your Bank or Mobile Operator.

What if a commercial call comes from a normal Spanish number?

Do not jump immediately to the conclusion that it is fraud.

The first question is whether the calling company is actually covered by the 400 requirement. As explained above, the legal scope and exceptions matter.

However, if a company that should be using 400 makes commercial calls from another range, the Spanish government says consumers can report the situation to the Telecommunications User Office (OAUT) or the CNMC, depending on the issue.

Where the problem is an unwanted commercial call or misuse of personal data, the AEPD may also be the relevant authority.

Keep evidence before you complain

The AEPD explains that a complaint about unwanted telephone advertising needs enough evidence to identify the caller and demonstrate what happened.

Useful evidence can include:

• a screenshot showing the calling number;
• the date and time of the call;
• a recording or other evidence of the commercial communication;
• information identifying the company being promoted;
• documentation showing that you are the holder or authorised user of the receiving telephone line.

Can you block all 400 calls?

The April 2026 resolution allows telephone operators to offer customers, on request, the possibility of disconnecting the commercial-call service provided through the 400 range.

In practice, availability and implementation may depend on your telecom provider. If you do not want to receive 400 calls, it is worth checking which blocking or disconnection options your operator currently offers.

This is potentially much easier than trying to block individual commercial numbers one by one.

The 400 prefix is only one part of Spain's anti-fraud plan

The 400 range did not appear in isolation.

Spain has been introducing a broader set of measures aimed at reducing telephone and messaging fraud.

On 16 October 2026, the Ministry for Digital Transformation reported that measures introduced since 2025 had enabled telecom operators to block more than 400 million fraudulent calls and close to 32 million fraudulent SMS messages.

Another important change took effect on 15 September 2026: the CNMC began operating a registry of alphanumeric sender aliases used by companies and public administrations for SMS, MMS and RCS messages.

According to the Ministry, more than six million messages using unregistered aliases, or using a registered alias without being its holder, had already been blocked by mid-October.

There is an interesting contrast here.

For registered messaging aliases, consumers can consult the CNMC system to check who owns an alias. For 400 commercial calls, OCU is asking for a similarly clear public mechanism to identify the company behind each number.

What does the 400 system actually solve?

The 400 system solves a real problem: before 17 October, an ordinary Spanish geographic or mobile-looking number did not clearly tell you whether the incoming call was commercial.

Now, when the rule applies, the purpose can be visible before you answer.

That gives users a useful choice.

You may be happy to answer commercial calls. You may decide to ignore them. Your phone or telecom operator may eventually use the range as a simple filtering signal.

But the system is not a complete caller-identification solution.

It answers:

“Is this number being used for a commercial call?”

It does not always answer:

“Which company is behind this exact number?”

And those are different questions.

Why the identity layer still matters

A useful telephone system needs more than categories.

Consider what a person actually wants to know when the phone rings:

• Who is calling?
• Why are they calling?
• Is this an official number?
• Can I safely call the organisation back through another channel?
• Which department or service is behind the call?

A prefix can solve one of those questions.

A structured, verified phone-number directory can help solve more of them.

This is also why phone directories remain relevant even in the age of search engines and AI. The useful information is no longer simply a list of numbers. It is the structured relationship between a number, an organisation, its purpose and the source that verifies it.

See Why Phone Directories Still Matter in the Age of AI for a deeper explanation.

Where Pingry fits

Pingry is building a verified phone-number directory for Spain.

The goal is not simply to tell users that a number exists. Where reliable information is available, Pingry aims to connect a number with:

• the organisation that publishes or uses it;
• the department or service behind the number;
• the purpose of the line;
• an official or authoritative source.

The arrival of 400 numbering makes the purpose of many commercial calls easier to recognise.

The next useful layer is identity.

As reliable information about 400 numbers becomes available from companies and official sources, that information can become part of the same verified-directory approach.

You can search existing official organisational numbers in the Pingry verified phone-number directory for Spain.

The bottom line: 400 tells you why, not necessarily who

Spain's new 400 range is a meaningful improvement.

For the first time, many commercial calls have a dedicated telephone identity that users can recognise before answering.

It creates clearer separation between sales and customer service. It gives telecom operators a stronger basis for detecting non-compliant commercial traffic. And because 400 numbers are outgoing-only, users cannot accidentally return calls to them.

But the prefix does not eliminate every uncertainty around an unknown call.

400 tells you why the phone may be ringing. A trustworthy caller-information system should also help you understand who is behind the number.

Frequently asked questions

What does the 400 prefix mean in Spain?

The 400 range is a dedicated Spanish numbering range for outgoing commercial calls. Since 17 October 2026, companies covered by the applicable rules must use 400 numbering for commercial calls, subject to the scope and exceptions established by Law 10/2025.

Can I call a Spanish 400 number back?

No. The 400 range is designed exclusively for outgoing commercial calls and cannot receive incoming calls. If you need to contact the organisation, find an independently verified customer-service or official contact number.

Does a 400 number mean the call is a scam?

No. The range was created for legitimate commercial calls. However, the prefix alone does not prove that a particular sales approach is lawful or that everything said during the call is trustworthy.

Does a 400 number mean the company had permission to call me?

No. Numbering and permission are separate issues. Commercial callers must still comply with Spain's rules on consent, legitimate interest, transparency and the right to object.

Do all businesses in Spain have to use 400 numbers?

Not literally every business. The formal 400 requirement is linked to companies within the scope of Law 10/2025, including specified basic services and large consumer businesses, and the legislation contains particular exceptions.

Can customer service call me from a 400 number?

The 400 range is not intended for customer-service calls. Spanish rules require commercial and customer-service telephone activity to use differentiated numbering.

What if I receive a commercial call from a number that does not start with 400?

First consider whether the company is covered by the 400 requirement. If it should be using 400 numbering, the Spanish government says non-compliance can be reported to the relevant telecommunications authorities. Unwanted marketing and data-protection issues may also fall within the competence of the AEPD.

Can I block all 400 calls?

The 2026 resolution allows telecom operators to offer customers the possibility of disconnecting commercial calls through the 400 range on request. Check with your operator to see which blocking options are currently available.

Does the 400 prefix tell me which company is calling?

Not by itself. It indicates commercial use. OCU has called for a public registry that would allow consumers to identify the company behind each 400 number.

Sources and further reading

• Boletín Oficial del Estado — Resolution of 14 April 2026 assigning the 400 numbering range for commercial calls
• Boletín Oficial del Estado — Law 10/2025 of 26 December on Customer Service
• Ministry for Digital Transformation — 16 October 2026 announcement on the 400 commercial-call range
• CNMC — Telecommunications numbering information and register
• AEPD — Guidance on unsolicited commercial calls with human intervention
• OCU — Position on 400 numbers and proposal for a public company-identity registry

This article provides general information about Spain's telephone-numbering and consumer-protection rules. It is not legal advice. Legal requirements can depend on the company, sector and circumstances of the call.